# Metricbeat 7.0.1 Windows Module Services **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [May 17, 2019, 10:13am UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-windows-module-services/181565 "2019-05-17T10:13:52Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Michi](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@Michi](https://discuss.elastic.co/u/Michi)\ **Post date:** [May 17, 2019, 10:13am UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-windows-module-services/181565/1 "2019-05-17T10:13:52Z")
I have a problem with the Metricbeat Windows module, I only want to monitor 5 specific services in the service monitoring. But it always transfers all events to Elasticsearch. I've tried filtering like this in the example: [https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-metricset-windows-service.html](https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-metricset-windows-service.html) ``` processors: - drop_event.when.not.equals: windows.service.display_name: Windows Firewall ``` and like this one: ``` processors: -drop_event: when: or: not: equals: windows.service.name: XXX6 not: equals: windows.service.name: XXX5 not: equals: windows.service.name: XXX3 not: equals: windows.service.name: XXX2 not: equals: windows.service.name: XXXX1 ``` What must be different for me to only receive events for the listed services? and I have a second problem, I can't see on the dashboard how much space is left on the Windows partitions. Do I have to configure it in the Windows module or system and if so how? The Metrictset filesystem and fsstat are active by default, but I still don't see how full/empty the partitions are in the dashboard. Seems that the information is missing. ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [May 28, 2019, 5:34pm UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-windows-module-services/181565/2 "2019-05-28T17:34:29Z")
Hi @Michi, just curious if you gave `and` a try instead of `or` because it's `not equals` here. If we pass a `windows.service.name` which equals to `XXX7`, then it has to compare with all names listed above and if none of them matches, then drop that event. Regarding to your second question, which metric exactly from metricbeat are you looking from the dashboard? ---
**Author:** ![Michi](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@Michi](https://discuss.elastic.co/u/Michi)\ **Post date:** [May 29, 2019, 7:01am UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-windows-module-services/181565/3 "2019-05-29T07:01:33Z")
I try the and instead of or, but still all events (services statusses) are submitted ![Unbenannt2](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d1fd0aa4b796a2f7f4be11375e20f407f1835beb.png) I want the partition size, the partitions are detected but its 0% all the time. ☹ ![Unbenannt](https://us1.discourse-cdn.com/elastic/original/3X/5/4/54e1b4d07f2965613a8d5d1f3d627bc0eebdfe1c.png) ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [May 30, 2019, 2:39pm UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-windows-module-services/181565/4 "2019-05-30T14:39:37Z")
@Michi Hmmm I will spend some time today to try the `drop_event`. Regarding to the `Disk Usage` part, In your system.yml or metricbeat.yml, do you have `filesystem` metricset enabled? ---
**Author:** ![Michi](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@Michi](https://discuss.elastic.co/u/Michi)\ **Post date:** [May 31, 2019, 4:05am UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-windows-module-services/181565/5 "2019-05-31T04:05:57Z")
Yes the filesystem metricset is enabled in system.yml. ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [June 5, 2019, 1:04am UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-windows-module-services/181565/6 "2019-06-05T01:04:21Z")
Sorry for the late response! For disk usage problem, I was able to reproduce it and found out the Disk Usage visualization is displaying Top 10 `system.filesystem.used.pct` and Order by `Doc Count` instead of Order by `Average of system.filesystem.used.pct`. Also group by is using `system.filesystem.mount_point` instead of `system.filesystem.device_name`. ![41%20PM](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5b988ea007da9cacdb91103f989dd461f6b65bf.png) Also if you toggle the different options around, some data shows up 😢 Do you want to create an issue for this in [github](https://github.com/elastic/beats/issues/new?template=bug-report.md) for this? Or I can do it tomorrow. ---
**Author:** ![Michi](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@Michi](https://discuss.elastic.co/u/Michi)\ **Post date:** [June 5, 2019, 4:23am UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-windows-module-services/181565/7 "2019-06-05T04:23:14Z")
i created a issue on github: [https://github.com/elastic/beats/issues/12435](https://github.com/elastic/beats/issues/12435) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 3, 2019, 4:23am UTC](https://discuss.elastic.co/t/metricbeat-7-0-1-windows-module-services/181565/8 "2019-07-03T04:23:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.